{"record":{"id":"aebf2b02f2498e5a","repo":"vxcontrol/pentagi","slug":"flows-invalidrequest","errorCode":"Flows.InvalidRequest","errorMessage":"group field not found","messagePattern":"group field not found","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"backend/pkg/server/services/flows.go","lineNumber":115,"sourceCode":"\t\tscope = func(db *gorm.DB) *gorm.DB {\n\t\t\treturn db\n\t\t}\n\t} else if slices.Contains(privs, \"flows.view\") {\n\t\tscope = func(db *gorm.DB) *gorm.DB {\n\t\t\treturn db.Where(\"user_id = ?\", uid)\n\t\t}\n\t} else {\n\t\tlogger.FromContext(c).Errorf(\"error filtering user role permissions: permission not found\")\n\t\tresponse.Error(c, response.ErrNotPermitted, nil)\n\t\treturn\n\t}\n\n\tquery.Init(\"flows\", flowsSQLMappers)\n\n\tif query.Group != \"\" {\n\t\tif _, ok := flowsSQLMappers[query.Group]; !ok {\n\t\t\tlogger.FromContext(c).Errorf(\"error finding flows grouped: group field not found\")\n\t\t\tresponse.Error(c, response.ErrFlowsInvalidRequest, errors.New(\"group field not found\"))\n\t\t\treturn\n\t\t}\n\n\t\tvar respGrouped flowsGrouped\n\t\tif respGrouped.Total, err = query.QueryGrouped(s.db, &respGrouped.Grouped, scope); err != nil {\n\t\t\tlogger.FromContext(c).WithError(err).Errorf(\"error finding flows grouped\")\n\t\t\tresponse.Error(c, response.ErrInternal, err)\n\t\t\treturn\n\t\t}\n\n\t\tresponse.Success(c, http.StatusOK, respGrouped)\n\t\treturn\n\t}\n\n\tif resp.Total, err = query.Query(s.db, &resp.Flows, scope); err != nil {\n\t\tlogger.FromContext(c).WithError(err).Errorf(\"error finding flows\")\n\t\tresponse.Error(c, response.ErrInternal, err)\n\t\treturn","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/services/flows.go#L97-L133","documentation":"GetFlows supports a 'group' query parameter that must name a column known to flowsSQLMappers. When the requested group field is not in the mapper whitelist, the service rejects the query with this Flows.InvalidRequest error instead of building an unsafe/unknown GROUP BY.","triggerScenarios":"GET /flows?group=<field> where <field> is not one of the keys in flowsSQLMappers (typo, wrong casing, or a field that is not groupable, e.g. group=status_text when only group=status exists).","commonSituations":"Frontend sending a computed/alias column name instead of the raw mapper key; API version drift after mappers were renamed; hand-written integrations guessing field names; localized or camelCase names passed where the mapper uses snake_case.","solutions":["Use a valid group field name listed in flowsSQLMappers (check pkg/server/services/flows.go for allowed keys).","Fix casing/snake_case mismatches (e.g. group=type, not group=Type).","Update the frontend dropdown/filter to emit only mapper-backed field names.","If a new grouping field is genuinely needed, add it to flowsSQLMappers server-side."],"exampleFix":"// before\nGET /flows?group=flowStatus\n// after\nGET /flows?group=status","handlingStrategy":"validation","validationCode":"const ALLOWED_GROUPS = ['status','type','created_at']; // mirror flowsSQLMappers\nif (group && !ALLOWED_GROUPS.includes(group)) {\n  throw new Error(`group field not found: ${group}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  const flows = await getFlows({ group });\n  render(flows);\n} catch (e) {\n  if (e.code === 'Flows.InvalidRequest' && /group field not found/.test(e.message)) {\n    setGroup(null); // fall back to ungrouped view\n    notify('Unsupported grouping; showing ungrouped results.');\n  } else { throw e; }\n}","preventionTips":["Generate the groupable-field list from the backend mappers instead of hardcoding.","Use snake_case names exactly as defined in flowsSQLMappers.","Add an integration test per group field the UI exposes.","On upgrade, diff mapper keys against frontend group options."],"tags":["validation","query-params","sql"],"backgroundTag":"invalid-group-field","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}